chore(deps): bump vulnerable dependencies

packages/core/src/node/start.ts

@@ -39,8 +39,9 @@ export async function startDevTools(
   })
 
   const { createServer } = await import('node:http')
-  const { defineHandler, H3, sendRedirect } = await import('h3')
-  const { toNodeHandler } = await import('h3/node')
+  // Import from `h3/node`, not bare `h3`: Nuxt 4.6 pins bare `h3` to its own v1 types in the
+  // generated tsconfigs of the Nuxt apps that type-check this file.
+  const { defineHandler, H3, sendRedirect, toNodeHandler } = await import('h3/node')
   const { mountStaticHandler } = await import('devframe/utils/serve-static')
   const { resolveStaticAssetsSource } = await import('devframe/utils/remote-assets')
 

packages/oxc/src/app/composables/rpc.ts

@@ -1,6 +1,7 @@
 // oxlint-disable unicorn/require-module-specifiers
 // oxlint-disable unicorn/require-module-specifiers
 import type {} from '@vitejs/devtools'
+import type { ConnectionMeta } from '@vitejs/devtools-kit'
 import type { DevToolsRpcClient } from '@vitejs/devtools-kit/client'
 import type {} from '../../../src/node/rpc'
 import { getDevToolsRpcClient } from '@vitejs/devtools-kit/client'
@@ -48,7 +49,7 @@ export async function connect() {
     // standalone (devframe CLI) it is served from the app's own base. Probe
     // both, keeping the base that answered first so the WS URL resolves there.
     let bases = [DEVTOOLS_MOUNT_PATH, runtimeConfig.app.baseURL]
-    let connectionMeta = runtimeConfig.app.connection
+    let connectionMeta = runtimeConfig.app.connection as ConnectionMeta | undefined
     if (!connectionMeta) {
       const resolved = await resolveConnection(bases)
       if (resolved) {

packages/rolldown/src/app/composables/rpc.ts

@@ -1,4 +1,5 @@
 import type {} from '@vitejs/devtools'
+import type { ConnectionMeta } from '@vitejs/devtools-kit'
 import type { DevToolsRpcClient } from '@vitejs/devtools-kit/client'
 import type {} from '../../node/rpc'
 import { getDevToolsRpcClient } from '@vitejs/devtools-kit/client'
@@ -25,7 +26,7 @@ export async function connect() {
         runtimeConfig.app.baseURL,
       ],
       cacheOptions: true,
-      connectionMeta: runtimeConfig.app.connection,
+      connectionMeta: runtimeConfig.app.connection as ConnectionMeta | undefined,
       wsOptions: {
         onConnected: () => {
           connectionState.connected = true

packages/vite/src/app/composables/rpc.ts

@@ -1,4 +1,5 @@
 import type {} from '@vitejs/devtools'
+import type { ConnectionMeta } from '@vitejs/devtools-kit'
 import type { DevToolsRpcClient } from '@vitejs/devtools-kit/client'
 import type { ViteInspectModuleUpdatedState } from '../../node/rpc'
 import { getDevToolsRpcClient } from '@vitejs/devtools-kit/client'
@@ -65,7 +66,7 @@ export async function connect() {
         runtimeConfig.app.baseURL,
       ],
       cacheOptions: true,
-      connectionMeta: runtimeConfig.app.connection,
+      connectionMeta: runtimeConfig.app.connection as ConnectionMeta | undefined,
       wsOptions: {
         onConnected: () => {
           rpcConnectionState.connected = true